hostapd/driver_madwifi.c

   1 /*
   2  * hostapd / Driver interaction with MADWIFI 802.11 driver
   3  * Copyright (c) 2004, Sam Leffler <sam@errno.com>
   4  * Copyright (c) 2004, Video54 Technologies
   5  * Copyright (c) 2005-2007, Jouni Malinen <j@w1.fi>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18 #include <net/if.h>
  19 #include <sys/ioctl.h>
  20
  21 #include <include/compat.h>
  22 #include <net80211/ieee80211.h>
  23 #ifdef WME_NUM_AC
  24 /* Assume this is built against BSD branch of madwifi driver. */
  25 #define MADWIFI_BSD
  26 #include <net80211/_ieee80211.h>
  27 #endif /* WME_NUM_AC */
  28 #include <net80211/ieee80211_crypto.h>
  29 #include <net80211/ieee80211_ioctl.h>
  30
  31 /*
  32  * Avoid conflicts with hostapd definitions by undefining couple of defines
  33  * from madwifi header files.
  34  */
  35 #undef RSN_VERSION
  36 #undef WPA_VERSION
  37 #undef WPA_OUI_TYPE
  38
  39
  40 #ifdef IEEE80211_IOCTL_SETWMMPARAMS
  41 /* Assume this is built against madwifi-ng */
  42 #define MADWIFI_NG
  43 #endif /* IEEE80211_IOCTL_SETWMMPARAMS */
  44
  45 #include "wireless_copy.h"
  46
  47 #include "hostapd.h"
  48 #include "driver.h"
  49 #include "ieee802_1x.h"
  50 #include "eloop.h"
  51 #include "priv_netlink.h"
  52 #include "sta_info.h"
  53 #include "l2_packet/l2_packet.h"
  54
  55 #include "wpa.h"
  56 #include "radius/radius.h"
  57 #include "ieee802_11.h"
  58 #include "accounting.h"
  59 #include "common.h"
  60
  61
  62 struct madwifi_driver_data {
  63         struct hostapd_data *hapd;              /* back pointer */
  64
  65         char    iface[IFNAMSIZ + 1];
  66         int     ifindex;
  67         struct l2_packet_data *sock_xmit;       /* raw packet xmit socket */
  68         struct l2_packet_data *sock_recv;       /* raw packet recv socket */
  69         int     ioctl_sock;                     /* socket for ioctl() use */
  70         int     wext_sock;                      /* socket for wireless events */
  71         int     we_version;
  72         u8      acct_mac[ETH_ALEN];
  73         struct hostap_sta_driver_data acct_data;
  74
  75         struct l2_packet_data *sock_raw; /* raw 802.11 management frames */
  76 };
  77
  78 static int madwifi_sta_deauth(void *priv, const u8 *addr, int reason_code);
  79
  80 static int
  81 set80211priv(struct madwifi_driver_data *drv, int op, void *data, int len)
  82 {
  83         struct iwreq iwr;
  84         int do_inline = len < IFNAMSIZ;
  85
  86         memset(&iwr, 0, sizeof(iwr));
  87         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
  88 #ifdef IEEE80211_IOCTL_FILTERFRAME
  89         /* FILTERFRAME must be NOT inline, regardless of size. */
  90         if (op == IEEE80211_IOCTL_FILTERFRAME)
  91                 do_inline = 0;
  92 #endif /* IEEE80211_IOCTL_FILTERFRAME */
  93         if (do_inline) {
  94                 /*
  95                  * Argument data fits inline; put it there.
  96                  */
  97                 memcpy(iwr.u.name, data, len);
  98         } else {
  99                 /*
 100                  * Argument data too big for inline transfer; setup a
 101                  * parameter block instead; the kernel will transfer
 102                  * the data for the driver.
 103                  */
 104                 iwr.u.data.pointer = data;
 105                 iwr.u.data.length = len;
 106         }
 107
 108         if (ioctl(drv->ioctl_sock, op, &iwr) < 0) {
 109 #ifdef MADWIFI_NG
 110                 int first = IEEE80211_IOCTL_SETPARAM;
 111                 static const char *opnames[] = {
 112                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 113                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 114                         "ioctl[IEEE80211_IOCTL_SETMODE]",
 115                         "ioctl[IEEE80211_IOCTL_GETMODE]",
 116                         "ioctl[IEEE80211_IOCTL_SETWMMPARAMS]",
 117                         "ioctl[IEEE80211_IOCTL_GETWMMPARAMS]",
 118                         "ioctl[IEEE80211_IOCTL_SETCHANLIST]",
 119                         "ioctl[IEEE80211_IOCTL_GETCHANLIST]",
 120                         "ioctl[IEEE80211_IOCTL_CHANSWITCH]",
 121                         "ioctl[IEEE80211_IOCTL_GET_APPIEBUF]",
 122                         "ioctl[IEEE80211_IOCTL_SET_APPIEBUF]",
 123                         "ioctl[IEEE80211_IOCTL_GETSCANRESULTS]",
 124                         "ioctl[IEEE80211_IOCTL_FILTERFRAME]",
 125                         "ioctl[IEEE80211_IOCTL_GETCHANINFO]",
 126                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 127                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 128                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 129                         NULL,
 130                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 131                         NULL,
 132                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 133                         NULL,
 134                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 135                         NULL,
 136                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 137                         NULL,
 138                         "ioctl[IEEE80211_IOCTL_WDSMAC]",
 139                         NULL,
 140                         "ioctl[IEEE80211_IOCTL_WDSDELMAC]",
 141                         NULL,
 142                         "ioctl[IEEE80211_IOCTL_KICKMAC]",
 143                 };
 144 #else /* MADWIFI_NG */
 145                 int first = IEEE80211_IOCTL_SETPARAM;
 146                 static const char *opnames[] = {
 147                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 148                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 149                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 150                         "ioctl[SIOCIWFIRSTPRIV+3]",
 151                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 152                         "ioctl[SIOCIWFIRSTPRIV+5]",
 153                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 154                         "ioctl[SIOCIWFIRSTPRIV+7]",
 155                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 156                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 157                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 158                         "ioctl[SIOCIWFIRSTPRIV+11]",
 159                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 160                         "ioctl[SIOCIWFIRSTPRIV+13]",
 161                         "ioctl[IEEE80211_IOCTL_CHANLIST]",
 162                         "ioctl[SIOCIWFIRSTPRIV+15]",
 163                         "ioctl[IEEE80211_IOCTL_GETRSN]",
 164                         "ioctl[SIOCIWFIRSTPRIV+17]",
 165                         "ioctl[IEEE80211_IOCTL_GETKEY]",
 166                 };
 167 #endif /* MADWIFI_NG */
 168                 int idx = op - first;
 169                 if (first <= op &&
 170                     idx < (int) (sizeof(opnames) / sizeof(opnames[0])) &&
 171                     opnames[idx])
 172                         perror(opnames[idx]);
 173                 else
 174                         perror("ioctl[unknown???]");
 175                 return -1;
 176         }
 177         return 0;
 178 }
 179
 180 static int
 181 set80211param(struct madwifi_driver_data *drv, int op, int arg)
 182 {
 183         struct iwreq iwr;
 184
 185         memset(&iwr, 0, sizeof(iwr));
 186         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 187         iwr.u.mode = op;
 188         memcpy(iwr.u.name+sizeof(__u32), &arg, sizeof(arg));
 189
 190         if (ioctl(drv->ioctl_sock, IEEE80211_IOCTL_SETPARAM, &iwr) < 0) {
 191                 perror("ioctl[IEEE80211_IOCTL_SETPARAM]");
 192                 wpa_printf(MSG_DEBUG, "%s: Failed to set parameter (op %d "
 193                            "arg %d)", __func__, op, arg);
 194                 return -1;
 195         }
 196         return 0;
 197 }
 198
 199 static const char *
 200 ether_sprintf(const u8 *addr)
 201 {
 202         static char buf[sizeof(MACSTR)];
 203
 204         if (addr != NULL)
 205                 snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
 206         else
 207                 snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
 208         return buf;
 209 }
 210
 211 /*
 212  * Configure WPA parameters.
 213  */
 214 static int
 215 madwifi_configure_wpa(struct madwifi_driver_data *drv)
 216 {
 217         struct hostapd_data *hapd = drv->hapd;
 218         struct hostapd_bss_config *conf = hapd->conf;
 219         int v;
 220
 221         switch (conf->wpa_group) {
 222         case WPA_CIPHER_CCMP:
 223                 v = IEEE80211_CIPHER_AES_CCM;
 224                 break;
 225         case WPA_CIPHER_TKIP:
 226                 v = IEEE80211_CIPHER_TKIP;
 227                 break;
 228         case WPA_CIPHER_WEP104:
 229                 v = IEEE80211_CIPHER_WEP;
 230                 break;
 231         case WPA_CIPHER_WEP40:
 232                 v = IEEE80211_CIPHER_WEP;
 233                 break;
 234         case WPA_CIPHER_NONE:
 235                 v = IEEE80211_CIPHER_NONE;
 236                 break;
 237         default:
 238                 wpa_printf(MSG_ERROR, "Unknown group key cipher %u",
 239                            conf->wpa_group);
 240                 return -1;
 241         }
 242         wpa_printf(MSG_DEBUG, "%s: group key cipher=%d", __func__, v);
 243         if (set80211param(drv, IEEE80211_PARAM_MCASTCIPHER, v)) {
 244                 printf("Unable to set group key cipher to %u\n", v);
 245                 return -1;
 246         }
 247         if (v == IEEE80211_CIPHER_WEP) {
 248                 /* key length is done only for specific ciphers */
 249                 v = (conf->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
 250                 if (set80211param(drv, IEEE80211_PARAM_MCASTKEYLEN, v)) {
 251                         printf("Unable to set group key length to %u\n", v);
 252                         return -1;
 253                 }
 254         }
 255
 256         v = 0;
 257         if (conf->wpa_pairwise & WPA_CIPHER_CCMP)
 258                 v |= 1<<IEEE80211_CIPHER_AES_CCM;
 259         if (conf->wpa_pairwise & WPA_CIPHER_TKIP)
 260                 v |= 1<<IEEE80211_CIPHER_TKIP;
 261         if (conf->wpa_pairwise & WPA_CIPHER_NONE)
 262                 v |= 1<<IEEE80211_CIPHER_NONE;
 263         wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
 264         if (set80211param(drv, IEEE80211_PARAM_UCASTCIPHERS, v)) {
 265                 printf("Unable to set pairwise key ciphers to 0x%x\n", v);
 266                 return -1;
 267         }
 268
 269         wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
 270                    __func__, conf->wpa_key_mgmt);
 271         if (set80211param(drv, IEEE80211_PARAM_KEYMGTALGS, conf->wpa_key_mgmt)) {
 272                 printf("Unable to set key management algorithms to 0x%x\n",
 273                         conf->wpa_key_mgmt);
 274                 return -1;
 275         }
 276
 277         v = 0;
 278         if (conf->rsn_preauth)
 279                 v |= BIT(0);
 280         wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
 281                    __func__, conf->rsn_preauth);
 282         if (set80211param(drv, IEEE80211_PARAM_RSNCAPS, v)) {
 283                 printf("Unable to set RSN capabilities to 0x%x\n", v);
 284                 return -1;
 285         }
 286
 287         wpa_printf(MSG_DEBUG, "%s: enable WPA=0x%x", __func__, conf->wpa);
 288         if (set80211param(drv, IEEE80211_PARAM_WPA, conf->wpa)) {
 289                 printf("Unable to set WPA to %u\n", conf->wpa);
 290                 return -1;
 291         }
 292         return 0;
 293 }
 294
 295
 296 static int
 297 madwifi_set_iface_flags(void *priv, int dev_up)
 298 {
 299         struct madwifi_driver_data *drv = priv;
 300         struct ifreq ifr;
 301
 302         wpa_printf(MSG_DEBUG, "%s: dev_up=%d", __func__, dev_up);
 303
 304         if (drv->ioctl_sock < 0)
 305                 return -1;
 306
 307         memset(&ifr, 0, sizeof(ifr));
 308         os_strlcpy(ifr.ifr_name, drv->iface, IFNAMSIZ);
 309
 310         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
 311                 perror("ioctl[SIOCGIFFLAGS]");
 312                 return -1;
 313         }
 314
 315         if (dev_up)
 316                 ifr.ifr_flags |= IFF_UP;
 317         else
 318                 ifr.ifr_flags &= ~IFF_UP;
 319
 320         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
 321                 perror("ioctl[SIOCSIFFLAGS]");
 322                 return -1;
 323         }
 324
 325         if (dev_up) {
 326                 memset(&ifr, 0, sizeof(ifr));
 327                 os_strlcpy(ifr.ifr_name, drv->iface, IFNAMSIZ);
 328                 ifr.ifr_mtu = HOSTAPD_MTU;
 329                 if (ioctl(drv->ioctl_sock, SIOCSIFMTU, &ifr) != 0) {
 330                         perror("ioctl[SIOCSIFMTU]");
 331                         printf("Setting MTU failed - trying to survive with "
 332                                "current value\n");
 333                 }
 334         }
 335
 336         return 0;
 337 }
 338
 339 static int
 340 madwifi_set_ieee8021x(const char *ifname, void *priv, int enabled)
 341 {
 342         struct madwifi_driver_data *drv = priv;
 343         struct hostapd_data *hapd = drv->hapd;
 344         struct hostapd_bss_config *conf = hapd->conf;
 345
 346         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
 347
 348         if (!enabled) {
 349                 /* XXX restore state */
 350                 return set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 351                         IEEE80211_AUTH_AUTO);
 352         }
 353         if (!conf->wpa && !conf->ieee802_1x) {
 354                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_DRIVER,
 355                         HOSTAPD_LEVEL_WARNING, "No 802.1X or WPA enabled!");
 356                 return -1;
 357         }
 358         if (conf->wpa && madwifi_configure_wpa(drv) != 0) {
 359                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_DRIVER,
 360                         HOSTAPD_LEVEL_WARNING, "Error configuring WPA state!");
 361                 return -1;
 362         }
 363         if (set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 364                 (conf->wpa ?  IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
 365                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_DRIVER,
 366                         HOSTAPD_LEVEL_WARNING, "Error enabling WPA/802.1X!");
 367                 return -1;
 368         }
 369
 370         return 0;
 371 }
 372
 373 static int
 374 madwifi_set_privacy(const char *ifname, void *priv, int enabled)
 375 {
 376         struct madwifi_driver_data *drv = priv;
 377
 378         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
 379
 380         return set80211param(drv, IEEE80211_PARAM_PRIVACY, enabled);
 381 }
 382
 383 static int
 384 madwifi_set_sta_authorized(void *priv, const u8 *addr, int authorized)
 385 {
 386         struct madwifi_driver_data *drv = priv;
 387         struct ieee80211req_mlme mlme;
 388         int ret;
 389
 390         wpa_printf(MSG_DEBUG, "%s: addr=%s authorized=%d",
 391                    __func__, ether_sprintf(addr), authorized);
 392
 393         if (authorized)
 394                 mlme.im_op = IEEE80211_MLME_AUTHORIZE;
 395         else
 396                 mlme.im_op = IEEE80211_MLME_UNAUTHORIZE;
 397         mlme.im_reason = 0;
 398         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 399         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 400         if (ret < 0) {
 401                 wpa_printf(MSG_DEBUG, "%s: Failed to %sauthorize STA " MACSTR,
 402                            __func__, authorized ? "" : "un", MAC2STR(addr));
 403         }
 404
 405         return ret;
 406 }
 407
 408 static int
 409 madwifi_sta_set_flags(void *priv, const u8 *addr, int total_flags,
 410                       int flags_or, int flags_and)
 411 {
 412         /* For now, only support setting Authorized flag */
 413         if (flags_or & WLAN_STA_AUTHORIZED)
 414                 return madwifi_set_sta_authorized(priv, addr, 1);
 415         if (!(flags_and & WLAN_STA_AUTHORIZED))
 416                 return madwifi_set_sta_authorized(priv, addr, 0);
 417         return 0;
 418 }
 419
 420 static int
 421 madwifi_del_key(void *priv, const u8 *addr, int key_idx)
 422 {
 423         struct madwifi_driver_data *drv = priv;
 424         struct ieee80211req_del_key wk;
 425         int ret;
 426
 427         wpa_printf(MSG_DEBUG, "%s: addr=%s key_idx=%d",
 428                    __func__, ether_sprintf(addr), key_idx);
 429
 430         memset(&wk, 0, sizeof(wk));
 431         if (addr != NULL) {
 432                 memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
 433                 wk.idk_keyix = (u8) IEEE80211_KEYIX_NONE;
 434         } else {
 435                 wk.idk_keyix = key_idx;
 436         }
 437
 438         ret = set80211priv(drv, IEEE80211_IOCTL_DELKEY, &wk, sizeof(wk));
 439         if (ret < 0) {
 440                 wpa_printf(MSG_DEBUG, "%s: Failed to delete key (addr %s"
 441                            " key_idx %d)", __func__, ether_sprintf(addr),
 442                            key_idx);
 443         }
 444
 445         return ret;
 446 }
 447
 448 static int
 449 madwifi_set_key(const char *ifname, void *priv, const char *alg,
 450                 const u8 *addr, int key_idx,
 451                 const u8 *key, size_t key_len, int txkey)
 452 {
 453         struct madwifi_driver_data *drv = priv;
 454         struct ieee80211req_key wk;
 455         u_int8_t cipher;
 456         int ret;
 457
 458         if (strcmp(alg, "none") == 0)
 459                 return madwifi_del_key(drv, addr, key_idx);
 460
 461         wpa_printf(MSG_DEBUG, "%s: alg=%s addr=%s key_idx=%d",
 462                    __func__, alg, ether_sprintf(addr), key_idx);
 463
 464         if (strcmp(alg, "WEP") == 0)
 465                 cipher = IEEE80211_CIPHER_WEP;
 466         else if (strcmp(alg, "TKIP") == 0)
 467                 cipher = IEEE80211_CIPHER_TKIP;
 468         else if (strcmp(alg, "CCMP") == 0)
 469                 cipher = IEEE80211_CIPHER_AES_CCM;
 470         else {
 471                 printf("%s: unknown/unsupported algorithm %s\n",
 472                         __func__, alg);
 473                 return -1;
 474         }
 475
 476         if (key_len > sizeof(wk.ik_keydata)) {
 477                 printf("%s: key length %lu too big\n", __func__,
 478                        (unsigned long) key_len);
 479                 return -3;
 480         }
 481
 482         memset(&wk, 0, sizeof(wk));
 483         wk.ik_type = cipher;
 484         wk.ik_flags = IEEE80211_KEY_RECV | IEEE80211_KEY_XMIT;
 485         if (addr == NULL) {
 486                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 487                 wk.ik_keyix = key_idx;
 488                 wk.ik_flags |= IEEE80211_KEY_DEFAULT;
 489         } else {
 490                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 491                 wk.ik_keyix = IEEE80211_KEYIX_NONE;
 492         }
 493         wk.ik_keylen = key_len;
 494         memcpy(wk.ik_keydata, key, key_len);
 495
 496         ret = set80211priv(drv, IEEE80211_IOCTL_SETKEY, &wk, sizeof(wk));
 497         if (ret < 0) {
 498                 wpa_printf(MSG_DEBUG, "%s: Failed to set key (addr %s"
 499                            " key_idx %d alg '%s' key_len %lu txkey %d)",
 500                            __func__, ether_sprintf(wk.ik_macaddr), key_idx,
 501                            alg, (unsigned long) key_len, txkey);
 502         }
 503
 504         return ret;
 505 }
 506
 507
 508 static int
 509 madwifi_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
 510                    u8 *seq)
 511 {
 512         struct madwifi_driver_data *drv = priv;
 513         struct ieee80211req_key wk;
 514
 515         wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
 516                    __func__, ether_sprintf(addr), idx);
 517
 518         memset(&wk, 0, sizeof(wk));
 519         if (addr == NULL)
 520                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 521         else
 522                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 523         wk.ik_keyix = idx;
 524
 525         if (set80211priv(drv, IEEE80211_IOCTL_GETKEY, &wk, sizeof(wk))) {
 526                 wpa_printf(MSG_DEBUG, "%s: Failed to get encryption data "
 527                            "(addr " MACSTR " key_idx %d)",
 528                            __func__, MAC2STR(wk.ik_macaddr), idx);
 529                 return -1;
 530         }
 531
 532 #ifdef WORDS_BIGENDIAN
 533         {
 534                 /*
 535                  * wk.ik_keytsc is in host byte order (big endian), need to
 536                  * swap it to match with the byte order used in WPA.
 537                  */
 538                 int i;
 539                 u8 tmp[WPA_KEY_RSC_LEN];
 540                 memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 541                 for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
 542                         seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
 543                 }
 544         }
 545 #else /* WORDS_BIGENDIAN */
 546         memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 547 #endif /* WORDS_BIGENDIAN */
 548         return 0;
 549 }
 550
 551
 552 static int
 553 madwifi_flush(void *priv)
 554 {
 555 #ifdef MADWIFI_BSD
 556         u8 allsta[IEEE80211_ADDR_LEN];
 557         memset(allsta, 0xff, IEEE80211_ADDR_LEN);
 558         return madwifi_sta_deauth(priv, allsta, IEEE80211_REASON_AUTH_LEAVE);
 559 #else /* MADWIFI_BSD */
 560         return 0;               /* XXX */
 561 #endif /* MADWIFI_BSD */
 562 }
 563
 564
 565 static int
 566 madwifi_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
 567                              const u8 *addr)
 568 {
 569         struct madwifi_driver_data *drv = priv;
 570
 571 #ifdef MADWIFI_BSD
 572         struct ieee80211req_sta_stats stats;
 573
 574         memset(data, 0, sizeof(*data));
 575
 576         /*
 577          * Fetch statistics for station from the system.
 578          */
 579         memset(&stats, 0, sizeof(stats));
 580         memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
 581         if (set80211priv(drv,
 582 #ifdef MADWIFI_NG
 583                          IEEE80211_IOCTL_STA_STATS,
 584 #else /* MADWIFI_NG */
 585                          IEEE80211_IOCTL_GETSTASTATS,
 586 #endif /* MADWIFI_NG */
 587                          &stats, sizeof(stats))) {
 588                 wpa_printf(MSG_DEBUG, "%s: Failed to fetch STA stats (addr "
 589                            MACSTR ")", __func__, MAC2STR(addr));
 590                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 591                         memcpy(data, &drv->acct_data, sizeof(*data));
 592                         return 0;
 593                 }
 594
 595                 printf("Failed to get station stats information element.\n");
 596                 return -1;
 597         }
 598
 599         data->rx_packets = stats.is_stats.ns_rx_data;
 600         data->rx_bytes = stats.is_stats.ns_rx_bytes;
 601         data->tx_packets = stats.is_stats.ns_tx_data;
 602         data->tx_bytes = stats.is_stats.ns_tx_bytes;
 603         return 0;
 604
 605 #else /* MADWIFI_BSD */
 606
 607         char buf[1024], line[128], *pos;
 608         FILE *f;
 609         unsigned long val;
 610
 611         memset(data, 0, sizeof(*data));
 612         snprintf(buf, sizeof(buf), "/proc/net/madwifi/%s/" MACSTR,
 613                  drv->iface, MAC2STR(addr));
 614
 615         f = fopen(buf, "r");
 616         if (!f) {
 617                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) != 0)
 618                         return -1;
 619                 memcpy(data, &drv->acct_data, sizeof(*data));
 620                 return 0;
 621         }
 622         /* Need to read proc file with in one piece, so use large enough
 623          * buffer. */
 624         setbuffer(f, buf, sizeof(buf));
 625
 626         while (fgets(line, sizeof(line), f)) {
 627                 pos = strchr(line, '=');
 628                 if (!pos)
 629                         continue;
 630                 *pos++ = '\0';
 631                 val = strtoul(pos, NULL, 10);
 632                 if (strcmp(line, "rx_packets") == 0)
 633                         data->rx_packets = val;
 634                 else if (strcmp(line, "tx_packets") == 0)
 635                         data->tx_packets = val;
 636                 else if (strcmp(line, "rx_bytes") == 0)
 637                         data->rx_bytes = val;
 638                 else if (strcmp(line, "tx_bytes") == 0)
 639                         data->tx_bytes = val;
 640         }
 641
 642         fclose(f);
 643
 644         return 0;
 645 #endif /* MADWIFI_BSD */
 646 }
 647
 648
 649 static int
 650 madwifi_sta_clear_stats(void *priv, const u8 *addr)
 651 {
 652 #if defined(MADWIFI_BSD) && defined(IEEE80211_MLME_CLEAR_STATS)
 653         struct madwifi_driver_data *drv = priv;
 654         struct ieee80211req_mlme mlme;
 655         int ret;
 656
 657         wpa_printf(MSG_DEBUG, "%s: addr=%s", __func__, ether_sprintf(addr));
 658
 659         mlme.im_op = IEEE80211_MLME_CLEAR_STATS;
 660         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 661         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme,
 662                            sizeof(mlme));
 663         if (ret < 0) {
 664                 wpa_printf(MSG_DEBUG, "%s: Failed to clear STA stats (addr "
 665                            MACSTR ")", __func__, MAC2STR(addr));
 666         }
 667
 668         return ret;
 669 #else /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 670         return 0; /* FIX */
 671 #endif /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 672 }
 673
 674
 675 static int
 676 madwifi_set_opt_ie(const char *ifname, void *priv, const u8 *ie, size_t ie_len)
 677 {
 678         /*
 679          * Do nothing; we setup parameters at startup that define the
 680          * contents of the beacon information element.
 681          */
 682         return 0;
 683 }
 684
 685 static int
 686 madwifi_sta_deauth(void *priv, const u8 *addr, int reason_code)
 687 {
 688         struct madwifi_driver_data *drv = priv;
 689         struct ieee80211req_mlme mlme;
 690         int ret;
 691
 692         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 693                    __func__, ether_sprintf(addr), reason_code);
 694
 695         mlme.im_op = IEEE80211_MLME_DEAUTH;
 696         mlme.im_reason = reason_code;
 697         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 698         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 699         if (ret < 0) {
 700                 wpa_printf(MSG_DEBUG, "%s: Failed to deauth STA (addr " MACSTR
 701                            " reason %d)",
 702                            __func__, MAC2STR(addr), reason_code);
 703         }
 704
 705         return ret;
 706 }
 707
 708 static int
 709 madwifi_sta_disassoc(void *priv, const u8 *addr, int reason_code)
 710 {
 711         struct madwifi_driver_data *drv = priv;
 712         struct ieee80211req_mlme mlme;
 713         int ret;
 714
 715         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 716                    __func__, ether_sprintf(addr), reason_code);
 717
 718         mlme.im_op = IEEE80211_MLME_DISASSOC;
 719         mlme.im_reason = reason_code;
 720         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 721         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 722         if (ret < 0) {
 723                 wpa_printf(MSG_DEBUG, "%s: Failed to disassoc STA (addr "
 724                            MACSTR " reason %d)",
 725                            __func__, MAC2STR(addr), reason_code);
 726         }
 727
 728         return ret;
 729 }
 730
 731 static int
 732 madwifi_del_sta(struct madwifi_driver_data *drv, u8 addr[IEEE80211_ADDR_LEN])
 733 {
 734         struct hostapd_data *hapd = drv->hapd;
 735         struct sta_info *sta;
 736
 737         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
 738                 HOSTAPD_LEVEL_INFO, "disassociated");
 739
 740         sta = ap_get_sta(hapd, addr);
 741         if (sta != NULL) {
 742                 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 743                 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
 744                 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 745                 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
 746                 ap_free_sta(hapd, sta);
 747         }
 748         return 0;
 749 }
 750
 751 static int
 752 madwifi_process_wpa_ie(struct madwifi_driver_data *drv, struct sta_info *sta)
 753 {
 754         struct hostapd_data *hapd = drv->hapd;
 755         struct ieee80211req_wpaie ie;
 756         int ielen, res;
 757         u8 *iebuf;
 758
 759         /*
 760          * Fetch negotiated WPA/RSN parameters from the system.
 761          */
 762         memset(&ie, 0, sizeof(ie));
 763         memcpy(ie.wpa_macaddr, sta->addr, IEEE80211_ADDR_LEN);
 764         if (set80211priv(drv, IEEE80211_IOCTL_GETWPAIE, &ie, sizeof(ie))) {
 765                 wpa_printf(MSG_ERROR, "%s: Failed to get WPA/RSN IE",
 766                            __func__);
 767                 printf("Failed to get WPA/RSN information element.\n");
 768                 return -1;              /* XXX not right */
 769         }
 770         wpa_hexdump(MSG_MSGDUMP, "madwifi req WPA IE",
 771                     ie.wpa_ie, IEEE80211_MAX_OPT_IE);
 772         wpa_hexdump(MSG_MSGDUMP, "madwifi req RSN IE",
 773                     ie.rsn_ie, IEEE80211_MAX_OPT_IE);
 774         iebuf = ie.wpa_ie;
 775         /* madwifi seems to return some random data if WPA/RSN IE is not set.
 776          * Assume the IE was not included if the IE type is unknown. */
 777         if (iebuf[0] != WLAN_EID_VENDOR_SPECIFIC)
 778                 iebuf[1] = 0;
 779 #ifdef MADWIFI_NG
 780         if (iebuf[1] == 0 && ie.rsn_ie[1] > 0) {
 781                 /* madwifi-ng svn #1453 added rsn_ie. Use it, if wpa_ie was not
 782                  * set. This is needed for WPA2. */
 783                 iebuf = ie.rsn_ie;
 784                 if (iebuf[0] != WLAN_EID_RSN)
 785                         iebuf[1] = 0;
 786         }
 787 #endif /* MADWIFI_NG */
 788         ielen = iebuf[1];
 789         if (ielen == 0) {
 790                 printf("No WPA/RSN information element for station!?\n");
 791                 return -1;              /* XXX not right */
 792         }
 793         ielen += 2;
 794         if (sta->wpa_sm == NULL)
 795                 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr);
 796         if (sta->wpa_sm == NULL) {
 797                 printf("Failed to initialize WPA state machine\n");
 798                 return -1;
 799         }
 800         res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
 801                                   iebuf, ielen, NULL, 0);
 802         if (res != WPA_IE_OK) {
 803                 printf("WPA/RSN information element rejected? (res %u)\n", res);
 804                 return -1;
 805         }
 806         return 0;
 807 }
 808
 809 static int
 810 madwifi_new_sta(struct madwifi_driver_data *drv, u8 addr[IEEE80211_ADDR_LEN])
 811 {
 812         struct hostapd_data *hapd = drv->hapd;
 813         struct sta_info *sta;
 814         int new_assoc;
 815
 816         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
 817                 HOSTAPD_LEVEL_INFO, "associated");
 818
 819         sta = ap_get_sta(hapd, addr);
 820         if (sta) {
 821                 accounting_sta_stop(hapd, sta);
 822         } else {
 823                 sta = ap_sta_add(hapd, addr);
 824                 if (sta == NULL)
 825                         return -1;
 826         }
 827
 828         if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 829                 /* Cached accounting data is not valid anymore. */
 830                 memset(drv->acct_mac, 0, ETH_ALEN);
 831                 memset(&drv->acct_data, 0, sizeof(drv->acct_data));
 832         }
 833         accounting_sta_get_id(hapd, sta);
 834
 835         if (hapd->conf->wpa) {
 836                 if (madwifi_process_wpa_ie(drv, sta))
 837                         return -1;
 838         }
 839
 840         /*
 841          * Now that the internal station state is setup
 842          * kick the authenticator into action.
 843          */
 844         new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
 845         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
 846         wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
 847         hostapd_new_assoc_sta(hapd, sta, !new_assoc);
 848         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
 849         return 0;
 850 }
 851
 852 static void
 853 madwifi_wireless_event_wireless_custom(struct madwifi_driver_data *drv,
 854                                        char *custom)
 855 {
 856         wpa_printf(MSG_DEBUG, "Custom wireless event: '%s'", custom);
 857
 858         if (strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
 859                 char *pos;
 860                 u8 addr[ETH_ALEN];
 861                 pos = strstr(custom, "addr=");
 862                 if (pos == NULL) {
 863                         wpa_printf(MSG_DEBUG,
 864                                    "MLME-MICHAELMICFAILURE.indication "
 865                                    "without sender address ignored");
 866                         return;
 867                 }
 868                 pos += 5;
 869                 if (hwaddr_aton(pos, addr) == 0) {
 870                         ieee80211_michael_mic_failure(drv->hapd, addr, 1);
 871                 } else {
 872                         wpa_printf(MSG_DEBUG,
 873                                    "MLME-MICHAELMICFAILURE.indication "
 874                                    "with invalid MAC address");
 875                 }
 876         } else if (strncmp(custom, "STA-TRAFFIC-STAT", 16) == 0) {
 877                 char *key, *value;
 878                 u32 val;
 879                 key = custom;
 880                 while ((key = strchr(key, '\n')) != NULL) {
 881                         key++;
 882                         value = strchr(key, '=');
 883                         if (value == NULL)
 884                                 continue;
 885                         *value++ = '\0';
 886                         val = strtoul(value, NULL, 10);
 887                         if (strcmp(key, "mac") == 0)
 888                                 hwaddr_aton(value, drv->acct_mac);
 889                         else if (strcmp(key, "rx_packets") == 0)
 890                                 drv->acct_data.rx_packets = val;
 891                         else if (strcmp(key, "tx_packets") == 0)
 892                                 drv->acct_data.tx_packets = val;
 893                         else if (strcmp(key, "rx_bytes") == 0)
 894                                 drv->acct_data.rx_bytes = val;
 895                         else if (strcmp(key, "tx_bytes") == 0)
 896                                 drv->acct_data.tx_bytes = val;
 897                         key = value;
 898                 }
 899         }
 900 }
 901
 902 static void
 903 madwifi_wireless_event_wireless(struct madwifi_driver_data *drv,
 904                                             char *data, int len)
 905 {
 906         struct iw_event iwe_buf, *iwe = &iwe_buf;
 907         char *pos, *end, *custom, *buf;
 908
 909         pos = data;
 910         end = data + len;
 911
 912         while (pos + IW_EV_LCP_LEN <= end) {
 913                 /* Event data may be unaligned, so make a local, aligned copy
 914                  * before processing. */
 915                 memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
 916                 wpa_printf(MSG_MSGDUMP, "Wireless event: cmd=0x%x len=%d",
 917                            iwe->cmd, iwe->len);
 918                 if (iwe->len <= IW_EV_LCP_LEN)
 919                         return;
 920
 921                 custom = pos + IW_EV_POINT_LEN;
 922                 if (drv->we_version > 18 &&
 923                     (iwe->cmd == IWEVMICHAELMICFAILURE ||
 924                      iwe->cmd == IWEVCUSTOM)) {
 925                         /* WE-19 removed the pointer from struct iw_point */
 926                         char *dpos = (char *) &iwe_buf.u.data.length;
 927                         int dlen = dpos - (char *) &iwe_buf;
 928                         memcpy(dpos, pos + IW_EV_LCP_LEN,
 929                                sizeof(struct iw_event) - dlen);
 930                 } else {
 931                         memcpy(&iwe_buf, pos, sizeof(struct iw_event));
 932                         custom += IW_EV_POINT_OFF;
 933                 }
 934
 935                 switch (iwe->cmd) {
 936                 case IWEVEXPIRED:
 937                         madwifi_del_sta(drv, (u8 *) iwe->u.addr.sa_data);
 938                         break;
 939                 case IWEVREGISTERED:
 940                         madwifi_new_sta(drv, (u8 *) iwe->u.addr.sa_data);
 941                         break;
 942                 case IWEVCUSTOM:
 943                         if (custom + iwe->u.data.length > end)
 944                                 return;
 945                         buf = malloc(iwe->u.data.length + 1);
 946                         if (buf == NULL)
 947                                 return;         /* XXX */
 948                         memcpy(buf, custom, iwe->u.data.length);
 949                         buf[iwe->u.data.length] = '\0';
 950                         madwifi_wireless_event_wireless_custom(drv, buf);
 951                         free(buf);
 952                         break;
 953                 }
 954
 955                 pos += iwe->len;
 956         }
 957 }
 958
 959
 960 static void
 961 madwifi_wireless_event_rtm_newlink(struct madwifi_driver_data *drv,
 962                                                struct nlmsghdr *h, int len)
 963 {
 964         struct ifinfomsg *ifi;
 965         int attrlen, nlmsg_len, rta_len;
 966         struct rtattr * attr;
 967
 968         if (len < (int) sizeof(*ifi))
 969                 return;
 970
 971         ifi = NLMSG_DATA(h);
 972
 973         if (ifi->ifi_index != drv->ifindex)
 974                 return;
 975
 976         nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 977
 978         attrlen = h->nlmsg_len - nlmsg_len;
 979         if (attrlen < 0)
 980                 return;
 981
 982         attr = (struct rtattr *) (((char *) ifi) + nlmsg_len);
 983
 984         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 985         while (RTA_OK(attr, attrlen)) {
 986                 if (attr->rta_type == IFLA_WIRELESS) {
 987                         madwifi_wireless_event_wireless(
 988                                 drv, ((char *) attr) + rta_len,
 989                                 attr->rta_len - rta_len);
 990                 }
 991                 attr = RTA_NEXT(attr, attrlen);
 992         }
 993 }
 994
 995
 996 static void
 997 madwifi_wireless_event_receive(int sock, void *eloop_ctx, void *sock_ctx)
 998 {
 999         char buf[256];
1000         int left;
1001         struct sockaddr_nl from;
1002         socklen_t fromlen;
1003         struct nlmsghdr *h;
1004         struct madwifi_driver_data *drv = eloop_ctx;
1005
1006         fromlen = sizeof(from);
1007         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
1008                         (struct sockaddr *) &from, &fromlen);
1009         if (left < 0) {
1010                 if (errno != EINTR && errno != EAGAIN)
1011                         perror("recvfrom(netlink)");
1012                 return;
1013         }
1014
1015         h = (struct nlmsghdr *) buf;
1016         while (left >= (int) sizeof(*h)) {
1017                 int len, plen;
1018
1019                 len = h->nlmsg_len;
1020                 plen = len - sizeof(*h);
1021                 if (len > left || plen < 0) {
1022                         printf("Malformed netlink message: "
1023                                "len=%d left=%d plen=%d\n",
1024                                len, left, plen);
1025                         break;
1026                 }
1027
1028                 switch (h->nlmsg_type) {
1029                 case RTM_NEWLINK:
1030                         madwifi_wireless_event_rtm_newlink(drv, h, plen);
1031                         break;
1032                 }
1033
1034                 len = NLMSG_ALIGN(len);
1035                 left -= len;
1036                 h = (struct nlmsghdr *) ((char *) h + len);
1037         }
1038
1039         if (left > 0) {
1040                 printf("%d extra bytes in the end of netlink message\n", left);
1041         }
1042 }
1043
1044
1045 static int
1046 madwifi_get_we_version(struct madwifi_driver_data *drv)
1047 {
1048         struct iw_range *range;
1049         struct iwreq iwr;
1050         int minlen;
1051         size_t buflen;
1052
1053         drv->we_version = 0;
1054
1055         /*
1056          * Use larger buffer than struct iw_range in order to allow the
1057          * structure to grow in the future.
1058          */
1059         buflen = sizeof(struct iw_range) + 500;
1060         range = os_zalloc(buflen);
1061         if (range == NULL)
1062                 return -1;
1063
1064         memset(&iwr, 0, sizeof(iwr));
1065         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1066         iwr.u.data.pointer = (caddr_t) range;
1067         iwr.u.data.length = buflen;
1068
1069         minlen = ((char *) &range->enc_capa) - (char *) range +
1070                 sizeof(range->enc_capa);
1071
1072         if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
1073                 perror("ioctl[SIOCGIWRANGE]");
1074                 free(range);
1075                 return -1;
1076         } else if (iwr.u.data.length >= minlen &&
1077                    range->we_version_compiled >= 18) {
1078                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
1079                            "WE(source)=%d enc_capa=0x%x",
1080                            range->we_version_compiled,
1081                            range->we_version_source,
1082                            range->enc_capa);
1083                 drv->we_version = range->we_version_compiled;
1084         }
1085
1086         free(range);
1087         return 0;
1088 }
1089
1090
1091 static int
1092 madwifi_wireless_event_init(void *priv)
1093 {
1094         struct madwifi_driver_data *drv = priv;
1095         int s;
1096         struct sockaddr_nl local;
1097
1098         madwifi_get_we_version(drv);
1099
1100         drv->wext_sock = -1;
1101
1102         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
1103         if (s < 0) {
1104                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
1105                 return -1;
1106         }
1107
1108         memset(&local, 0, sizeof(local));
1109         local.nl_family = AF_NETLINK;
1110         local.nl_groups = RTMGRP_LINK;
1111         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
1112                 perror("bind(netlink)");
1113                 close(s);
1114                 return -1;
1115         }
1116
1117         eloop_register_read_sock(s, madwifi_wireless_event_receive, drv, NULL);
1118         drv->wext_sock = s;
1119
1120         return 0;
1121 }
1122
1123
1124 static void
1125 madwifi_wireless_event_deinit(void *priv)
1126 {
1127         struct madwifi_driver_data *drv = priv;
1128
1129         if (drv != NULL) {
1130                 if (drv->wext_sock < 0)
1131                         return;
1132                 eloop_unregister_read_sock(drv->wext_sock);
1133                 close(drv->wext_sock);
1134         }
1135 }
1136
1137
1138 static int
1139 madwifi_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
1140                    int encrypt, const u8 *own_addr)
1141 {
1142         struct madwifi_driver_data *drv = priv;
1143         unsigned char buf[3000];
1144         unsigned char *bp = buf;
1145         struct l2_ethhdr *eth;
1146         size_t len;
1147         int status;
1148
1149         /*
1150          * Prepend the Ethernet header.  If the caller left us
1151          * space at the front we could just insert it but since
1152          * we don't know we copy to a local buffer.  Given the frequency
1153          * and size of frames this probably doesn't matter.
1154          */
1155         len = data_len + sizeof(struct l2_ethhdr);
1156         if (len > sizeof(buf)) {
1157                 bp = malloc(len);
1158                 if (bp == NULL) {
1159                         printf("EAPOL frame discarded, cannot malloc temp "
1160                                "buffer of size %lu!\n", (unsigned long) len);
1161                         return -1;
1162                 }
1163         }
1164         eth = (struct l2_ethhdr *) bp;
1165         memcpy(eth->h_dest, addr, ETH_ALEN);
1166         memcpy(eth->h_source, own_addr, ETH_ALEN);
1167         eth->h_proto = htons(ETH_P_EAPOL);
1168         memcpy(eth+1, data, data_len);
1169
1170         wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", bp, len);
1171
1172         status = l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, bp, len);
1173
1174         if (bp != buf)
1175                 free(bp);
1176         return status;
1177 }
1178
1179 static void
1180 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
1181 {
1182         struct madwifi_driver_data *drv = ctx;
1183         struct hostapd_data *hapd = drv->hapd;
1184         struct sta_info *sta;
1185
1186         sta = ap_get_sta(hapd, src_addr);
1187         if (!sta || !(sta->flags & WLAN_STA_ASSOC)) {
1188                 printf("Data frame from not associated STA %s\n",
1189                        ether_sprintf(src_addr));
1190                 /* XXX cannot happen */
1191                 return;
1192         }
1193         ieee802_1x_receive(hapd, src_addr, buf + sizeof(struct l2_ethhdr),
1194                            len - sizeof(struct l2_ethhdr));
1195 }
1196
1197 static void *
1198 madwifi_init(struct hostapd_data *hapd)
1199 {
1200         struct madwifi_driver_data *drv;
1201         struct ifreq ifr;
1202         struct iwreq iwr;
1203
1204         drv = os_zalloc(sizeof(struct madwifi_driver_data));
1205         if (drv == NULL) {
1206                 printf("Could not allocate memory for madwifi driver data\n");
1207                 return NULL;
1208         }
1209
1210         drv->hapd = hapd;
1211         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1212         if (drv->ioctl_sock < 0) {
1213                 perror("socket[PF_INET,SOCK_DGRAM]");
1214                 goto bad;
1215         }
1216         memcpy(drv->iface, hapd->conf->iface, sizeof(drv->iface));
1217
1218         memset(&ifr, 0, sizeof(ifr));
1219         os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
1220         if (ioctl(drv->ioctl_sock, SIOCGIFINDEX, &ifr) != 0) {
1221                 perror("ioctl(SIOCGIFINDEX)");
1222                 goto bad;
1223         }
1224         drv->ifindex = ifr.ifr_ifindex;
1225
1226         drv->sock_xmit = l2_packet_init(drv->iface, NULL, ETH_P_EAPOL,
1227                                         handle_read, drv, 1);
1228         if (drv->sock_xmit == NULL)
1229                 goto bad;
1230         if (l2_packet_get_own_addr(drv->sock_xmit, hapd->own_addr))
1231                 goto bad;
1232         if (hapd->conf->bridge[0] != '\0') {
1233                 wpa_printf(MSG_DEBUG, "Configure bridge %s for EAPOL traffic.",
1234                            hapd->conf->bridge);
1235                 drv->sock_recv = l2_packet_init(hapd->conf->bridge, NULL,
1236                                                 ETH_P_EAPOL, handle_read, drv,
1237                                                 1);
1238                 if (drv->sock_recv == NULL)
1239                         goto bad;
1240         } else
1241                 drv->sock_recv = drv->sock_xmit;
1242
1243         memset(&iwr, 0, sizeof(iwr));
1244         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1245
1246         iwr.u.mode = IW_MODE_MASTER;
1247
1248         if (ioctl(drv->ioctl_sock, SIOCSIWMODE, &iwr) < 0) {
1249                 perror("ioctl[SIOCSIWMODE]");
1250                 printf("Could not set interface to master mode!\n");
1251                 goto bad;
1252         }
1253
1254         madwifi_set_iface_flags(drv, 0);        /* mark down during setup */
1255         madwifi_set_privacy(drv->iface, drv, 0); /* default to no privacy */
1256
1257         return drv;
1258 bad:
1259         if (drv->sock_xmit != NULL)
1260                 l2_packet_deinit(drv->sock_xmit);
1261         if (drv->ioctl_sock >= 0)
1262                 close(drv->ioctl_sock);
1263         if (drv != NULL)
1264                 free(drv);
1265         return NULL;
1266 }
1267
1268
1269 static void
1270 madwifi_deinit(void *priv)
1271 {
1272         struct madwifi_driver_data *drv = priv;
1273
1274         (void) madwifi_set_iface_flags(drv, 0);
1275         if (drv->ioctl_sock >= 0)
1276                 close(drv->ioctl_sock);
1277         if (drv->sock_recv != NULL && drv->sock_recv != drv->sock_xmit)
1278                 l2_packet_deinit(drv->sock_recv);
1279         if (drv->sock_xmit != NULL)
1280                 l2_packet_deinit(drv->sock_xmit);
1281         if (drv->sock_raw)
1282                 l2_packet_deinit(drv->sock_raw);
1283         free(drv);
1284 }
1285
1286 static int
1287 madwifi_set_ssid(const char *ifname, void *priv, const u8 *buf, int len)
1288 {
1289         struct madwifi_driver_data *drv = priv;
1290         struct iwreq iwr;
1291
1292         memset(&iwr, 0, sizeof(iwr));
1293         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1294         iwr.u.essid.flags = 1; /* SSID active */
1295         iwr.u.essid.pointer = (caddr_t) buf;
1296         iwr.u.essid.length = len + 1;
1297
1298         if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
1299                 perror("ioctl[SIOCSIWESSID]");
1300                 printf("len=%d\n", len);
1301                 return -1;
1302         }
1303         return 0;
1304 }
1305
1306 static int
1307 madwifi_get_ssid(const char *ifname, void *priv, u8 *buf, int len)
1308 {
1309         struct madwifi_driver_data *drv = priv;
1310         struct iwreq iwr;
1311         int ret = 0;
1312
1313         memset(&iwr, 0, sizeof(iwr));
1314         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1315         iwr.u.essid.pointer = (caddr_t) buf;
1316         iwr.u.essid.length = len;
1317
1318         if (ioctl(drv->ioctl_sock, SIOCGIWESSID, &iwr) < 0) {
1319                 perror("ioctl[SIOCGIWESSID]");
1320                 ret = -1;
1321         } else
1322                 ret = iwr.u.essid.length;
1323
1324         return ret;
1325 }
1326
1327 static int
1328 madwifi_set_countermeasures(void *priv, int enabled)
1329 {
1330         struct madwifi_driver_data *drv = priv;
1331         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
1332         return set80211param(drv, IEEE80211_PARAM_COUNTERMEASURES, enabled);
1333 }
1334
1335 static int
1336 madwifi_commit(void *priv)
1337 {
1338         return madwifi_set_iface_flags(priv, 1);
1339 }
1340
1341 const struct wpa_driver_ops wpa_driver_madwifi_ops = {
1342         .name                   = "madwifi",
1343         .init                   = madwifi_init,
1344         .deinit                 = madwifi_deinit,
1345         .set_ieee8021x          = madwifi_set_ieee8021x,
1346         .set_privacy            = madwifi_set_privacy,
1347         .set_encryption         = madwifi_set_key,
1348         .get_seqnum             = madwifi_get_seqnum,
1349         .flush                  = madwifi_flush,
1350         .set_generic_elem       = madwifi_set_opt_ie,
1351         .wireless_event_init    = madwifi_wireless_event_init,
1352         .wireless_event_deinit  = madwifi_wireless_event_deinit,
1353         .sta_set_flags          = madwifi_sta_set_flags,
1354         .read_sta_data          = madwifi_read_sta_driver_data,
1355         .send_eapol             = madwifi_send_eapol,
1356         .sta_disassoc           = madwifi_sta_disassoc,
1357         .sta_deauth             = madwifi_sta_deauth,
1358         .set_ssid               = madwifi_set_ssid,
1359         .get_ssid               = madwifi_get_ssid,
1360         .set_countermeasures    = madwifi_set_countermeasures,
1361         .sta_clear_stats        = madwifi_sta_clear_stats,
1362         .commit                 = madwifi_commit,
1363 };